-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: perl, all versions
Date: Thursday, August 10th, 2000
Affected SuSE versions: 6.0-6.4, 7.0
Vulnerability Type: local root compromise
Severity (1-10): 5
SuSE default package: yes, but not configured exploitable.
Other affected systems: all linux systems using this package
Content of this advisory:
1) security vulnerability resolved: suidperl (local root compromise)
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, temporary workarounds
(Netscape)
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
suidperl is the perl interpreter for suid perl scripts, a part of the
perl package. A maliciously implemented feature causes the interpreter
to spawn the /bin/mail program to inform the superuser of its usage,
thereby passing on untrusted environment that causes /bin/mail to
execute arbitrary commands as user root.
SuSE distributions are not susceptible to this problem because
/usr/bin/suidperl is mode 755 (not suid) by default. Administrators
must explicitly have enabled suidperl by changing the permission modes
of the interpreter to 4755 root.root (suid root) for the exploit
mechanism to work.
In SuSE-Linux, activating suidperl is done by changing one of the
files /etc/permissions.(easy|secure) and running SuSEconfig or
`chkstat -set /etc/permissions.(easy|secure)', alternatively,
depending on the setting of PERMISSION_SECURITY in /etc/rc.config.
If SuSEconfig is turned off completely, the administrator of the
system is obliged to change the permission modes by hand.
The decision to not activate suidperl has been made because
security problems were expected in the wild.
O/S vendors have provided updated packages for both suidperl and
mailx, the package containing /bin/mail. Basically, /bin/mail's
fetures are not the origin of the security hole because the
hostile environment is passed on by the suidperl interpreter,
despite the fact that the interpreter runs suid root.
Note: The upcoming SuSE-7.0 distribution _is_ vulnerable to the
problem of this advisory if /usr/bin/suidperl is setuid root.
However, suidperl is installed with mode 755 after the
installation like in older SuSE Linux distributions and
therefore can't be exploited without prior manual activation
of suidperl by the system administrator.
SuSE provides an updated package for the vulnerable software. It is
strongly recommended to upgrade to the latest version found on our
ftp server as described below. The package removes the mail
notification and uses the syslog facility (priority warning) instead.
Chose one of the following paths to download the package from our
ftp server and install the package with the command `rpm -Fhv file.rpm'.
The md5sum for each file is in the line below.
You can verify the integrity of the rpm files using the command
`rpm --checksig --nogpg file.rpm', independently from the md5
signatures below.
i386 Intel Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/perl.rpm
01c855f752b835536403c7bcc74d8114
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/perl.spm
16c850efed03cc5bd5b9bff3910dd6e4
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/perl.rpm
0640e11ba0b87f0d8a01b4b5dedbb8eb
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/perl.spm
a68ade45a65e73805b2276ad35266d46
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/perl.rpm
7a3c2adae0c556a7ccb647eaca34e6c7
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/perl.spm
6bc207d360a1349f8f8067a83061f848
SuSE-6.2
ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/perl.rpm
6403b21d3795def485ad4a577a38c3be
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/perl.spm
47760a9798dc1489ca9fd2ee3a1756f6
SuSE-6.1
ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/perl.rpm
ac14b4fccfb10e5465f377b095621730
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/perl.spm
7d3aec7879fabcac3d2b7e4996340c31
AXP Alpha Platform:
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/perl.rpm
47853649c4683748558dbb72f759d739
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/perl.spm
5949a68b6126afdca98224cd6ed4be74
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/perl.rpm
994804e426adf718df64162c92a1ce84
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/perl.spm
879238a9e443bbe32cc4d421ed9a5d28
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/perl.rpm
cf2d763fb562a75395c5e613704cbd10
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/perl.spm
e0aa5d0c91f474592e56eed2a8b3fae0
PPC Power PC Platform:
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/perl.rpm
828a210ef2b3aa462161010d4d19416a
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/perl.spm
9253498d7c474ad2e9f8dabe576d2c96
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds
This section addresses currently known vulnerabilities in Linux/Unix
systems that have not been resolved up to the release date of this
advisory.
- Netscape, versions from 3.0 to 4.73:
The latest version of Netscape is currently being tested. SuSE
Netscape rpms contain efficient workarounds against some "morbid"
properties of Netscape in order to provide stable packages.
These additions are being reworked right now.
Also, cryprographical software export regulations require us to
wait for the permission to redistribute the netscape package from
our US-American ftp server.
There are currently two known vulnerabilities in Netscape versions
from 3.0 to 4.73:
a) a buffer overflow in the jpeg image handling code
b) a security flaw in Netscape's Java implementation
a) has been fixed in Netscape version 4.74. Updated packages
from SuSE will follow very soon.
Temporary fix/workaround:
problem a) Turn off automatic image loading and do not
click on images to trigger the download. This may
be a fairly unsatisfying solution.
problem b) Turn off Java and JavaScript.
- ntop
ntop is a network statistics visualization utility which offers
graphical analysis of network traffic and other statistics with
a web browser. By default, ntop listens on port 3000 and requires
no or a commonly known authentication password to view the data.
ntop is only installed in network server selections and is not
activated by default in SuSE Linux installations.
The ntop packages shipped with SuSE Linux did not exhibit the
unsafe behaviour when a file like /../../etc/passwd is referenced.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security@suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to